wwbn/avideo Security Advisories for 26.0 (67)
-
[MEDIUM] AVideo: Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
PKSA-8d75-pkrm-ryk2 CVE-2026-35452 GHSA-99j6-hj87-6fcf
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php
PKSA-yv5c-84v4-5kzs CVE-2026-35450 GHSA-2vg4-rrx4-qcpq
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
PKSA-8k5g-7b6v-dmzw CVE-2026-35449 GHSA-hg8q-8wqr-35xx
Affected version: <=26.0
Reported by:
GitHub -
[LOW] AVideo: Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php
PKSA-v2fv-f7cj-pvmk CVE-2026-35448 GHSA-3v7m-qg4x-58h9
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
PKSA-6czf-bc7p-h4k6 CVE-2026-35181 GHSA-4q27-4rrq-fx95
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
PKSA-9kdr-v9xz-q97d CVE-2026-35179 GHSA-x9w5-xccw-5h9w
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin
PKSA-h129-dyyg-hqpq GHSA-gmpc-fxg2-vcmq
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation
PKSA-v4v4-994j-g46x CVE-2026-34740 GHSA-x5vx-vrpf-r45f
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
PKSA-trzy-nkyc-3bq1 CVE-2026-34739 GHSA-jqrj-chh6-8h78
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter
PKSA-4yg6-hdf3-cm7q CVE-2026-34738 GHSA-m577-w9j8-ch7j
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug
PKSA-jw1r-58j1-stm1 CVE-2026-34737 GHSA-38rh-4v39-vfxv
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
PKSA-tjqt-v3v3-pg6b CVE-2026-34733 GHSA-wwpw-hrx8-79r5
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints
PKSA-mshg-1d1p-db19 CVE-2026-34732 GHSA-g2mg-cgr6-vmv7
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php
PKSA-nbcf-22q2-3259 CVE-2026-34731 GHSA-4jcg-jxpf-5vq3
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: DOM XSS via Unsanitized Display Name in WebSocket Call Notification
PKSA-nph7-q1m2-1jj5 CVE-2026-34716 GHSA-w4hp-w536-jg64
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
PKSA-bppj-bwtk-gjyq CVE-2026-34613 GHSA-hqxf-mhfw-rc44
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
PKSA-zmm3-dkmp-577r CVE-2026-34611 GHSA-c4xj-x7p8-3x7q
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel
PKSA-8d8v-tnwh-mvxd CVE-2026-34396 GHSA-v4h7-3x43-qqw4
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo vulnerable to Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php
PKSA-9wd9-hqm1-g8vw CVE-2026-34395 GHSA-77jp-mgcw-rfmr
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking
PKSA-sgq7-y46w-x6wm CVE-2026-34394 GHSA-4wwr-7h7c-chqr
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page
PKSA-vp5k-2k3q-kh8x CVE-2026-34375 GHSA-pm37-62g7-p768
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification
PKSA-jgsk-3v13-mp5q CVE-2026-34369 GHSA-q6jj-r49p-94fh
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
PKSA-r7hg-81sr-ph3s CVE-2026-34368 GHSA-h54m-c522-h6qr
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php
PKSA-zrqg-465j-tm13 CVE-2026-34364 GHSA-73gr-r64q-7jh4
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
PKSA-3yrj-j1ff-gsp4 CVE-2026-34362 GHSA-2mg4-pfgx-64cf
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications
PKSA-6jcq-63hk-b922 CVE-2026-34247 GHSA-g3hj-mf85-679g
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
PKSA-fw58-yv1p-mjjv CVE-2026-34245 GHSA-2rm7-j397-3fqg
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo: Unauthenticated Access to Payment Log DataTables Endpoints Exposes Transaction Data, PayPal Tokens, and User Financial Records
PKSA-mhr2-p9hx-xy4j GHSA-wprj-9cvc-5w37
Affected version: <=26.0
Reported by:
GitHub -
[CRITICAL] AVideo has Plaintext Video Password Storage
PKSA-vcf8-yygk-smvm CVE-2026-33867 GHSA-363v-5rh8-23wg
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables
PKSA-d1c1-62x6-fsdv CVE-2026-33770 GHSA-584p-rpvq-35vf
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions
PKSA-ggc8-4vpf-v295 CVE-2026-33764 GHSA-g39v-qrj6-jxrh
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle
PKSA-qmkf-gp88-ftk6 CVE-2026-33763 GHSA-8prq-2jr2-cm92
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings
PKSA-t2zr-g4vs-n5nr CVE-2026-33761 GHSA-j724-5c6c-68g5
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
PKSA-kzzd-7tpm-2718 CVE-2026-33759 GHSA-75qq-68m8-pvfr
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter
PKSA-c9d6-fz2f-92mg CVE-2026-33723 GHSA-ffr8-fxhv-fv8h
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment
PKSA-nk6y-bx1m-kq7t CVE-2026-33719 GHSA-r64r-883r-wcwh
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL
PKSA-xbpw-5md3-j3nz CVE-2026-33717 GHSA-8wf4-c4x3-h952
Affected version: <=26.0
Reported by:
GitHub -
[CRITICAL] AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
PKSA-7gff-yt7v-8bkx CVE-2026-33716 GHSA-9hv9-gvwm-95f2
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()
PKSA-x77f-z8vb-hbfr CVE-2026-33690 GHSA-8p2x-5cpm-qrqw
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
PKSA-6bhm-ppng-rh7j GHSA-wxjx-r2j2-96fx
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
PKSA-rmrd-1jny-519s CVE-2026-33688 GHSA-m99f-mmvg-3xmx
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
PKSA-rhxf-1yfy-x5fd CVE-2026-33685 GHSA-j36m-74g2-7m95
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field
PKSA-cx3j-v85y-y9tv CVE-2026-33683 GHSA-ghx5-7jjg-q2j7
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name
PKSA-9p99-sn38-6cwv CVE-2026-33681 GHSA-3hwv-x8g3-9qpr
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()
PKSA-m663-qqs4-57t4 CVE-2026-33651 GHSA-pvw4-p2jm-chjm
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo: Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion
PKSA-kbvc-x3nh-bwr5 CVE-2026-33650 GHSA-8x77-f38v-4m5j
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification
PKSA-nfgn-q1hy-xddr CVE-2026-33649 GHSA-g8x9-7mgh-7cvj
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path
PKSA-cpqv-3x62-47s6 CVE-2026-33648 GHSA-5m4q-5cvx-36mw
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload
PKSA-sv6m-nx8k-5kz3 CVE-2026-33647 GHSA-wxjw-phj6-g75w
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)
PKSA-2x5y-pg7k-8jx1 CVE-2026-33513 GHSA-8fw8-q79c-fp9m
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has an unauthenticated decrypt oracle leaking any ciphertext
PKSA-stv4-sw5c-pp7h CVE-2026-33512 GHSA-mwjc-5j4x-r686
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload
PKSA-9rhr-hzp4-skcj CVE-2026-33507 GHSA-hv36-p4w4-6vmj
Affected version: <=26.0
Reported by:
GitHub -
[CRITICAL] AVideo has Unauthenticated SSRF via plugin/Live/test.php
PKSA-734r-s438-vkf3 CVE-2026-33502 GHSA-3fpm-8rjr-v5mc
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin
PKSA-93k3-9zdh-zky7 CVE-2026-33501 GHSA-96qp-8cmq-jvq8
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo - Incomplete Fix for CVE-2026-27568: Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization
PKSA-fjmv-8jwk-wtsg CVE-2026-33500 GHSA-72h5-39r7-r26j
Affected version: <=26.0
Reported by:
GitHub -
[MEDIUM] AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
PKSA-g9zg-y2pv-yf4q CVE-2026-33499 GHSA-7292-w8qp-mhq2
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter
PKSA-28kd-gd4j-w94p CVE-2026-33493 GHSA-83xq-8jxj-4rxm
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration
PKSA-3ybr-q6r1-fnzm CVE-2026-33492 GHSA-x3pr-vrhq-vq43
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
PKSA-qjdg-5npg-72ng CVE-2026-33488 GHSA-6m5f-j7w2-w953
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter
PKSA-v7r8-5fwd-x92z CVE-2026-33485 GHSA-8p58-35c3-ccxx
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php
PKSA-f4gx-6t2c-nrd6 CVE-2026-33483 GHSA-vv7w-qf5c-734w
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()
PKSA-tp22-rjkg-27h5 CVE-2026-33482 GHSA-pmj8-r2j7-xg6c
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
PKSA-8d9c-5xxm-8vns CVE-2026-33480 GHSA-p3gr-g84w-g8hh
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
PKSA-4kfk-t6qg-77z2 CVE-2026-33479 GHSA-xggw-g9pm-9qhh
Affected version: <=26.0
Reported by:
GitHub -
[HIGH] AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`
PKSA-6mc5-gbk2-4jkz CVE-2026-33354 GHSA-4jw9-5hrc-m4j6
Affected version: <=26.0
Reported by:
GitHub -
[CRITICAL] AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
PKSA-zqc4-q9ns-kq82 CVE-2026-33352 GHSA-mcj5-6qr4-95fj
Affected version: <=26.0
Reported by:
GitHub -
[CRITICAL] AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
PKSA-kz4k-1fdq-4jkn CVE-2026-33351 GHSA-5f7v-4f6g-74rj
Affected version: <=26.0
Reported by:
GitHub